1. Field of the Invention
The present invention relates to scanning email messages to detect whether the messages include spam, and in particular, to rescanning email messages that have already been delivered with updated spam detection rules.
2. Description of the Related Art
The prevalence of unsolicited commercial email, commonly known as spam has grown rapidly and is still growing. The corporate world and individual home users are spending millions of dollars to combat spam. Internet Service Providers (ISPs) have to cope with greatly increasing day-to-day amounts of network traffic due to the increase in spam emails. If spam traffic continues to grow, it may become unmanageable in the near future.
Typically, spam has been fought by the use of software that scans incoming email messages to determine whether each message is spam. Typical methods for scanning and detecting that an email message is spam include email filtering based on the content of the email, DNS-based blackhole lists (DNSBL), greylisting, sender reputation, spamtraps, enforcing technical requirements, checksumming systems to detect bulk email, and by putting some sort of cost on the sender via a Proof-of-work system or a micropayment.
Typically, Anti-Spam software is installed at the mail server level in a corporate environment, and scans emails as they are received at the mail gateway or email server. The messages are scanned for spam at this time, and if they are not detected as spam they are then delivered to the user's inbox.
The emails are scanned by the latest anti-spam rules, but these may not detect certain messages as spam. It is common that Anti-spam companies receive spam samples at around the same time as customers and existing anti-spam rules may not be able to proactively block some spam, so subsequent anti-spam rule updates may include updated rules to detect spam that was previously missed a few minutes prior. Because the messages have already been scanned and delivered to the users inbox, they are not marked as spam even though newer anti-spam signatures would mark them as such. A significant percentage of missed spam is spam that was not detected at the time it was received, but was subsequently detected with newer anti-spam rules.
A need arises for a technique that increases the accuracy of spam scanning and reduces the need for users to submit missed spam in emails that was not detected at the time the emails were received, but would subsequently be detected with newer anti-spam rules.